gcp-eventarc-explicit-trigger-has-policy
An Eventarc trigger has an IAM allow policy governing who may manage it.
match (record)
{
"api": "eventarc.projects.locations.triggers.getIamPolicy",
"field": "bindings"
}
emit
| source type | EventRule |
|---|---|
| target type | Policy |
| source | <Eventarc trigger node (EventRule)> |
| target | <trigger ResourcePolicy node> |
Narrative
{trigger.name} has an IAM allow policy controlling who may view, update, or delete it.
Raw rule rules/explicit/gcp-eventarc.yaml
id: gcp-eventarc-explicit-trigger-has-policy
emits: HasPolicy
description: An Eventarc trigger has an IAM allow policy governing who may manage it.
match_record:
api: eventarc.projects.locations.triggers.getIamPolicy
field: bindings
emit:
source_type: EventRule
target_type: Policy
source: <Eventarc trigger node (EventRule)>
target: <trigger ResourcePolicy node>
narrative: '{trigger.name} has an IAM allow policy controlling who may view, update, or delete it.'